Formal Modeling of IoT and Drone-Based Forest Fire Detection and Counteraction System

Abstract

Forests are an enduring component of the natural world and perform a vital role in protecting the environment. Forests are valuable resources to control global warming and provide oxygen for the survival of human life, including wood for households. Forest fires have recently emerged as a major threat to biological processes and the ecosystem. Unfortunately, almost every year, fire damages millions of hectares of forest land due to late and inefficient detection of fire. However, it is important to identify the forest fire at the initial level before it spreads to vast areas and destroys natural resources. In this paper, a formal model of the Internet of Things (IoT) and drone-based forest fire detection and counteraction system is presented. The proposed system comprises network maintenance. Sensor deployment is on trees, the ground, and animals in the form of subnets to transmit sensed data to the control room. All subnets are connected to the control room through gateway nodes. Alarms are being used to alert human beings and animals to save their lives, which will help to initially protect them from fire. The embedded sensors collect the information and transfer it to the gateways. Drones are being used for real-time visualization of fire-affected areas and to perform actions to control fires because they play a vital role in disasters. Graph theory is used to construct an efficient model and to show the connectivity of the network. To identify failures and develop recovery procedures, the algorithm is designed through the graph-based model. The model is developed by the Vienna Development Method-Specification Language (VDM-SL), and the correctness of the model is ensured using various VDM-SL toolbox facilities.

1. Introduction

IoT is anticipated to grow progressively due to the development of networking systems, availability of sensors, and computing networks [1]. Agriculture, industry, academia, and environment monitoring are major fields for the application of IoT technologies to constantly track and monitor [1]. Smart systems have been developed as a technical response to social and environmental challenges, and they have been applied worldwide to make the lives of people more productive and profitable. For these purposes, a wide number of applications are being created. Smart forests appear now as a feasible choice for long-term natural ecological sustainability, including environmental health analysis, especially in relation to climate change, wildlife tracking, surveillance systems, and early warning of fires and natural disasters [2].

The forest is a large region dominated by plants and animals, occupying almost four billion hectares, or about 30 percent of the world’s land area [3]. Forests have a massive environmental impact that saves the earth from overheating and, to a larger degree, reduces human-caused pollution. Therefore, a fire in a forest induces a serious risk and may cause an immense environmental disaster, increasing the loss of human lives and wildlife and causing harm to the environment and economy, such as biodiversity. These forest fires are rapidly spreading and unacknowledged, and every year, in many countries, many human beings and animals are injured and die [3]. Forest monitoring and regulation is therefore an extremely significant problem, and there is a need to find appropriate ways to minimize forest fires and preserve valuable resources.

In recent years, researchers have been paying attention to the development of forest fire identification systems to address these problems. The majority of research has been conducted using most of these main strategies, such as human-based surveillance systems, satellite networks, image sensors, wireless sensor networks (WSN), and IoT [4]. A deep learning algorithm named convolutional neural network (CNN) has been utilized [5] with IoT and smart sensors to detect huge forest fire disasters. In [6], the authors presented a fire detection system as a convergence of WSN, UAV, and cloud computing. To classify a fire incident with greater precision, image processing techniques are also incorporated. In [7], information fusion method and WSN techniques have been used for detecting fires at the initial stages. The authors proposed a UAV-based system using an IR sensor for forest fire surveillance. In [8], to improve the reliability and accuracy of forest fire detection, this technique has taken advantage of both the light and motion properties of fire in IR images.

For system development, formal models provide many advantages and are very beneficial because they collect the system requirements and specifications at an early stage to provide the accuracy and correctness of the model. The sensitive applications are required to be formalized before real-time testing to avoid any major loss. Therefore, without developing a formal model, it is not possible to make these applications error free. Furthermore, formal modeling-based development lead to the avoidance of major errors, such as run time errors, plan change at the time of errors, rapid changes in design, consumption of extra resources, and time.

In this paper, IoT and drone-based forest fire detection and a counteracting system have been designed, and it is an extended version of our previous paper [9]. In this article, we have included one more major module of the system with the name Network, maintenance and failure detection with depth formal modeling, and system specifications. Furthermore, we have improved formal specifications of fire detection and counteraction systems to remove errors at the abstract level, which creates the main difference in contribution. IoT-based sensors are deployed on the trees, ground, and animals to collect information and send it to the control room to extinguish the fire. The animal sensor is deployed on the animal’s body to detect their body temperature and behavior, where other sensors are deployed on the trees and ground. Drones are known as flying robots, so they can efficiently control the fire at early stages. If sensors detect anything that indicates fire, then information will be passed to the control room. The controller sends the signals to the drone to visualize the forest area where the sensors detected the fire. In the case of fire, the monitoring drones will check the intensity of the fire and send back information to the control room for timely decisions to control the fire before it spreads.

Retaining connection of the network is another essential problem, since whenever a device stops working, the network is isolated in different parts. To deal with the failure of nodes, there are three approaches: proactive, reactive, and hybrid. The proactive methods focus on building and preserving the biconnected topology, which results in a huge number of actors, increased costs, and inefficiency. Reactive methods are useful for observing faults at an early stage and for initiating repair procedures. Pre-failure preparation and post-failure recovery are assumed in hybrid methods, which are a combination of reactive and proactive methods. In the proposed work, the reactive method is used to identify the failure of network nodes, and recovery will be established by the control room. The control room is responsible for installing a new sensor and drone in case of a failure report, as shown in Figure 1.

To minimize human interaction in network maintenance, graph theory is used to provide an effective data structure for information storage [10].

The semi-formal model is converted into a formal model by utilizing the different resources available in the VDM-SL toolbox for correct functioning of the system. Formal methods are useful to ensure correctness in order to resolve simulation and testing limitations. Mathematical notations represent the formal approaches that are beneficial for modeling, defining, and evaluating the characteristics of security, operational structures, and complicated systems. Today’s researchers have adopted formal methods for formalizing systems in different areas [11,12,13,14,15].

2. Related Work

A variety of detecting and monitoring systems have been proposed by the researchers; in the following section, a brief overview of these studies has been discussed. The multiple SC approaches were added to the MNP dataset to evaluate an efficient indicator that theoretically provides more reliable results for forest fires [16]. Authors have presented a generalization of the classical inference in the Fuzzy Rule-Based Structure by overlapping functions and overlapping indices in [17]. A novel smoke detection system using CS Adaboost has been suggested in [18] to efficiently and effectively identify early forest fire smoke, which is motivated by the findings of the research in the forest fire video.

The static and complex structure analysis of fire in the detection of forest fires is proposed in [19]. The intense classifier of machine learning is used to identify the agent flame area as actual or non-flammable, depending on the derived texture characteristics. A systematic structure has been suggested in [20] by using WSN to identify and control forest fires. The purpose of the system is to identify the fire danger quickly. A new technique to identify flames from a stream of video has been introduced [21]. It took complete benefit of the flame’s motion mechanism and information related to color. An Unmanned Aircraft System (UAS) for wildfire control has been proposed [22], which consists of multiple unmanned aircrafts and a base station. The study states how this data can be acquired remotely through an UAS that has infrared or visual on-board cameras. A robust video analyzing methodology for quick flame identification in monitoring footage through temporal smoothing and regression analysis is presented in [23].

In [24], authors introduce a hybrid technique of forest fire detection utilizing both color and movement functionality for the analysis of pictures taken from a camera attached to a UAV that travels throughout the operation time. Add Net has been implemented [25] to the issue of detecting smoke in forest fires, where an event computation time’s reliability and reduced wrong alert rate is important. An effective method based on CNN has been suggested [26] for detecting fires from recorded videos in uncertain monitoring contexts. This paper [27] analyzed an energy-friendly and computer-efficient CNN framework that can detect fires and localize the fire scenario influenced by the construction of squeeze networks for semantic understanding. The aim of the study [28] is to detect wildfires at the earliest possible stage by incorporating a monitoring framework mainly composed of drones. The closest authorities will immediately be informed of the fireplace.

A solution for a smart system of networked nodes for fire detection is proposed [29] in small areas, such as small isolated homes and small villages, at a low cost. The solution includes the use of FIR sensors, which can detect, as well as locate, heat and perform some real-time protection mechanisms. Forest fire detection has been introduced in terms of early warnings by using many attached sensors for transmission and a satellite in the system for receiving signals and sending them to the ground station for further processing [30]. A neural network has been trained in this research [31], to conduct forest fire predictions. To predict fire hotspots, this system uses readily available remotely sensed information in the type of satellite pictures.

It considers a fleet of homogeneous small drones that could only reach locations and then use payloads individually but can conduct searching, surveillance, tracking, monitoring, aid, reporting, and transfer duties together. Two algorithms for detecting forest fires based on knowledge fusion approaches have been suggested in [32]. The first algorithm utilizes a threshold approach and nodes that are fitted with sensors for humidity, temperature, and light. The next algorithm is focused upon the principle of Dumpster–Shafer and suggests that humidity and temperature sensors are used by the nodes. A modern, effective forest fire detection method has been proposed [33], using networks with wireless sensors (WSNs). The detection accuracy of the proposed device is improved by applying multi-criteria detection, in which an alert judgment relies on several characteristics of a forest fire.

An updated edition of the algorithm aimed, in general, at minimizing the wrong alarm number is proposed in [34]. The revised version of the algorithm called SFIDE (Satellite Fire Detection) brings into consideration several approaches earlier produced for the detection of fire. This article [35] introduces an innovative approach for the identification of forest fires by the use of a new color map, the Forest Fire Detection Index (FFDI), created by the authors.

Failure Detection Review

The development and formal modeling of different systems has addressed a variety of research concerns that have attracted the interest of the research community. In the event of an inter-actor connectivity malfunction, the network topology will be disrupted, which may be inadequate to restore. Consequently, some of the researchers proposed failure recovery strategies. Below is a summary of that research. WSAN is partitioned into subnets in [36], that locate the fault recovery protocol at the subnet level to achieve the goal of performance. This paper [37] proposes a Partitioning Detection and Communication Restoration (PCR) algorithm to enable critical actor damage. Pre-designated replacement identifies the fault of its prime actor and establishes a post-failure restoration phase that could require organized multi-actor resettlement. The essential topic of failure restoration in WSANs is addressed in this paper [38], it introduced an innovative localized, distributed, hybrid subnet-based, and energy-efficient failure recovery algorithm.

A study on topology control strategies of wireless sensor networks to accommodate failure of nodes is described in [39]. A further constructive algorithm, PADRA, is presented [40], identifying CDS (connected dominating sets) through the entire network. That approach is ineffective toward crucial node recognition, as depth-first search (DFS) is conducted across each CDS component to determine if a node is a cut vertex or not. The least destructive topology repair (LeDiR) algorithm is proposed [41]. The algorithm is reactive and focuses on maintaining connectivity based on inter blocks. Likewise, this paper [42] presents an Application-centric Recovery (ACR) hybrid algorithm that distinguishes primary crucial entities through localized information and selects an appropriate replacement. A variant algorithm of backup assigning based on subnet in WSANs is introduced in this paper [43], for security and mission-critical complex networks.

Table 1. Most relevant existing studies with limitations.

References	Description	Limitations
[44]	The study focused on effective fire detection and proposed some algorithms to apply them on UAVs for the reduction of false alarms. Using these techniques, color identification, Smoke Motion Recognition, Fire Classification algorithms, and the helicopters cameras in them for visualization.	Using only drones for fire detection can be expensive, there is no mechanism in place to deal with drone failure and the system is not formalized.
[45]	A neural network has been trained in this research to conduct forest fire predictions. To predict fire hotspots, this system uses readily available remotely-sensed information in the type of satellite pictures.	This system uses satellite images for fire prediction that can cause late detection of fire. Further, there is no formalization for this system.
[46]	An algorithm named FFDEA has been presented using WSAN for the detection of forest fire and extinguishment system. Temperature sensors are used to detect fire and to combat the fire; robots, as actors, are utilized. This system is formalized using VDM-SL.	In this system, just a temperature sensor is utilized, which is ineffective for precise fire detection and increases the false alert rate. In addition, there is no mechanism for confirmation of fire and no network maintenance available.

presents the most relevant existing studies with their limitations.

According to the findings of the literature research, only a few systems have included formal methods; as a result, the existing system has not been thoroughly formalized, and the system’s correctness cannot be guaranteed. We formalized the system using VDMSL to address these issues, and the system’s correctness is ensured utilizing the VDM-SL toolbox’s capabilities.

3. Problem Statement & System Model

The most critical considerations in combating forest fires include the detection of a fire at its early stages, proper categorization of fire, and rapid response from fire prevention units. A vast variety of well-studied strategies are out there to solve this issue, but there is still some improvement needed because those systems are time-consuming. Established structures depend on semi-formal approaches, simulation, and checking, which are only appropriate for evaluating quantitative performance but do not guarantee correctness. Hence, several innovations have been developed, such as formal methods that can make the systems more efficient. The motivation of this paper is that none of the studies exist in this area using IoT and drones by integrating the approaches of graph theory and formal methods. Most importantly, there is a lack of system maintenance for the failure recovery of the network.

The major objectives of this paper are to overcome these issues by constructing an optimized network using IoT devices for forest fire detection and counteraction, to develop a formal model of the system by integrating approaches to perform timely actions precisely, and to identify network failures, develop recovery procedures, and validate the formal model by utilizing the different resources available in the VDM-SL toolbox for validation and verification of the system.

3.1. Sequence Diagram

Sequence diagrams describe the system’s behavior by determining how objects communicate with one another to accomplish the objectives. Once we design the system, we can define the sequence using the sequence diagram. A management system shows strong behavior throughout all situations across all times; hence, every device can provide information at any time. As this system is IoT-based, there is online communication between all the objects. In Figure 2, the sequence of the system shows how the fire will be detected and how the action will be performed.

3.2. Graph-Based Model

Graph theory refers to the mathematical constructs used to describe the whole network and the connectivity of the objects with each other. It also offers many approaches to problem solving. The subnet-based mechanism is shown through a graph in which all the objects are uniquely identified, which will also help in identifying the failure of nodes. The subnet is also known as a subnetwork, where a wider network is segmented into sections. The reason for choosing subnet deployment is to enhance the network’s energy efficiency.

It reduces the unnecessary traffic load on network routes, resulting in faster network speed. The graph-based system model is presented in Figure 3. In the graph, a set of vertices comprises nodes and a set of edges as connections for the representation of the network.

In this graph, different nodes are shown in the subnets, such as sensor nodes, alarm nodes, gateway nodes, drones as actor nodes, and a control room node. The powerful node of the system is selected as gateway, and drones are directly connected to the control room. There is a link among the pair of nodes, which means all the nodes in the subnet are connected to each other and the gateways. The subnets are linked with the control room through gateways with an edge.

4. Specifying Model Formally Using VDM-SL

The formal specification using VDM-SL of the forest fire and counteraction system is defined in this segment. Various constructs, such as sets, invariants, composite elements, and pre- and post-conditions, are used to construct the formal definition. There are two parts of the proposed model: static and dynamic. The static model defines the data types, while the dynamic model specifies the functions, operations, and state.

4.1. Static Model

The system consists of different nodes having similar attributes and is defined in Node as a composite object consisting of six variables, and the description is given. Ndid shows that each node has a unique identity. Pos shows that each node is notified of its position. The Power node has the power low or high. Status is used to check whether the sensor is active or sleeping. FireInfo records that the information of fire is transmitted or received. Signal is used for sending signals from the gateway to the control room. The connect variable is used to check the connection of nodes.

The Link represents the connection between two nodes, and the connectivity of the network is represented by the Links relationship. In the network, every two nodes are identical, which means that both can communicate with each other. A node is not connected to itself, which indicates that the network does not have a loop.

Composite objects of alarm and sensors

The alarm is also a node and defined as a composite object having two fields. The alnode accesses the attributes of the object NODE, and other shows that either alarm’s mode will be on or off.

The formal definition of the sensor attached to the animal’s body is defined as AnimalSensor in the composite object with four fields and a description. The asnode is used to access the attributes of the earlier specified object NODE. The animals variable is used to show the attachment of certain sensors to a collection of animals. The temp is used to monitor the body temperature of the animal, and animal behavior defines the behavior of the animals.

The invariant for this sensor is defined as the uniquely identified sensors are connected to limited animals. If the temperature of the animal’s body changes from normal and the behavior is panicked, worried, or the animal runs away from their place, then the sensor’s status becomes active otherwise it stays asleep.

The composite object TempSensor is described here as displaying five fields for detecting temperature in the forest, and the description is given. The tsnode accesses attributes of the object NODE. The tsdeployed indicates that a set of sensors is deployed at a specific location. The con_nds displays the connection of nodes that are connected, and the temperature field records the current and natural temperature.

The invariant is defined as: the set of sensors deployed on the trees and ground to check the temperature of the forest. If the temperature rises from the threshold value, then the status of the sensor becomes active and fire information will be sent else the status remains sleep. The connection of the sensor node is enabled if and only if the neighbor set is not empty.

To detect the humidity level in the forest, the HumidSensor was used as a composite object. The description of the fields is defined in the given table. The hsnode accesses attributes of the object NODE. The hsdeployed indicates that a set of sensor nodes are deployed at a specific location. The humid field records the current and natural humidity level.

The invariant is defined as: the group of sensors placed on trees and the ground to monitor the humidity level in the forest. If the humidity decreases, then the sensor’s state changes to active and fire information is sent; otherwise, the status remains sleep.

The third type of sensor is for detecting the flame emission described as FlameSensor with six fields. The flamedeployed denotes the deployment of a group of sensor nodes in a given area. The con_nds is used to show the connection between the nodes, and the flame emission field records whether the flame is emitted or not.

In the invariant, it is described that if the flame emission is detected, then the status will be active, and the information is transmitted for actions; otherwise, the status will be asleep. The sensor nodes are linked if and only if the set of neighbor’s nodes is not empty; otherwise, they are not connected.

The smoke sensor is specified as SmokeSensor, having four fields and working the same as the flame sensor defined above.

Five types of sensor nodes are being utilized to detect the fire in the forest, which is defined as a Sensor with seven fields. The first five fields describe the animal sensor, temperature sensor, humidity sensor, flame sensor, and smoke sensor. The sixth field alarm will check the mode of the alarm. The last field detection is used for checking whether the fire is detected or not.

The Invariant is specified as: the status of detection and is FDETECTED if and only if the status of any sensors becomes active and the mode of the alarm is on. Otherwise, the detection will be FNOTDETECTED and the statuses of all the sensors are asleep and the alarm’s mode will also be off.

The gateway node is the most powerful node defined as a GateWay composite object with four fields, and the working is described. The gwnode is used to access the characteristics of the object NODE; this field is used. The sense denotes that the gateway will obtain information sensed by the sensors. The gwmde is used to show the mode of the gateway if fire information is obtained, and the con_gnds field is used to show the neighbors of the gateway node.

The invariant is described as: the power of gateway is high, and the mode is idle. The fire info will be received if and only if sensors detect the fire, then the gateway becomes activated and transmits a signal to the control room for immediate action. The gateway is connected to the control room if and only if the neighbor set is not empty.

The gateway then communicates with the control room, and the composite entity is named ControlRoom and has five variables. The crnode characteristics of the object node are being accessed. The order shows that the control room can send instructions to drones. The con_crnbrs is used to demonstrate the control room’s relation to other nodes.

The invariant is described as: the power of the crnode is high, and if a signal from the gateway node is received, control will give instructions to the monitoring and actor drone; otherwise, no order will be issued.

Composite objects of drones

The monitoring drone is defined as the composite object consisting of six fields. Mdnode is used for accessing the characteristics of the object Node. The con_mdnds is used to show that the link of a drone is enabled or disabled. Order is accessing the ControlRoom to check whether the order is received or not. The mdrone mode shows that the drone is either idle or working. The mdroneaction field describes which action a monitoring drone will perform.

The invariant is described as: the power of mdnode is high, and if an order is received from control room, then the mode of the drone becomes working. A monitoring drone’s actions include real-time visualization and confirmation that it is their fire, or no fire found; otherwise, the mode would stay idle.

An actor drone, as composite object ADrone, is specified here with six fields, and an adnode is used for accessing the characteristics of the object Node. The order field has access to the ControlRoom to check whether the order is received or not. The admode is used to check the mode of the actor drone, and the adaction actions that the actor drone will take are described.

The invariant is explained here as: the power of the actor drone is high if the order is received from the control room, then actor drone will perform action to extinguish the fire.

Composite object of subnet: Subnets are used to execute the system, and each subnet is described as a composite object SNet. This consists of five fields; snetnodes denote that the subnet has a number of nodes. The sensors and alarms are used to show that a collection of sensors and alarms belongs to a subnet. The gateway subnet has access to the gateway node, and connections are used to specify the connectivity links between the nodes.

The invariant is described as: for each pair of nodes, there is a connection between them, and every link should have two nodes. Further, the nodes are identified to show the connections.

The graph-based topology of the network is described here as composite object GTtopology, consisting of nine fields. The subnet field specifies the existence of a group of subnets in the network. The croom is used to access the set of control rooms. The gtocrcon is used to show the connection of gateways with the control room. The mdrones and adrones both indicate that a set of monitoring and actor drones exists in the network. The mdtomdcon and crtomdcon are used to depict the links of the monitoring drones with one another and with the control room. The adtoadcon and crtoadcon both display the connections between actor drones and the control room.

The invariant is defined as: the subnets are linked to the control room by gateway nodes, and there is a connection from the gateway to the control room. There is a relationship between each pair of monitoring drones, and each link should have two drones, and there exists a connection from the control room to the monitoring drone. A similar connectivity relationship is described for actor drones as well.

4.2. Dynamic Model

In the dynamic model, the state and operations of the detection system of the forest fire are defined by utilizing all the items mentioned above. A FFDetection state consists of nine characteristics that are just now defined and initialized in the function named init.

The operations that change the state space of the system are described here. The operation FFDetected, with the input subnet, is defined for the fire detection process. If a fire is detected in any subnet, the process identified becomes true and sensors in the external clause are read.

The pre-condition is specified as: there must be sensors and alarms in the subnets, and the post-condition indicates that a fire has been observed if the status of some sensor is active or the alarm mode is on.

The next step after the detection of fire is information transfer, and the procedure is defined as InfoTransmission. It is detected in the input and returns true if fire is observed and the information is transmitted as well. The set of sensors and gateways is being read in the external clause.

It is being confirmed in the pre-condition that the fire is detected, and the post-condition shows that the fire information will be transmitted if and only if gateways receive that information from sensors.

After the information has been sent, the gateways will report it to the control room and the process transmitted is taken as input. The set of gateways is read in the external clause and written on the set of control rooms.

The transmission of information is confirmed in the pre-condition, the connections of the gateways and control room are shown in the post-condition, and the gateway sends a signal that is received by the control room.

When the control room receives signals from gateways, it issues an order to monitor drones, which is defined here in this operation. It reads a set of control rooms and writes on the mdrone in the external clause.

Pre-condition is true, and in the post-condition, the process monorder returns true if and only if the monitoring order is received from the control room. The connection between the monitoring drone and the control room is shown, and when the order is received, the drone will start visualizing the area to confirm the fire.

After visualizing the area, the drone will report back to the control room that the fire information is correct or not. The monorder process, node, and set of monitoring drones are taken as input.

In the pre-condition, the process monorder returns true as the visualization is done and in the post-condition drone provides the information that the fire is confirmed or there is no fire and goes back to its position.

After confirmation of fire, the control room issues orders to the actor drone to combat the fire. It takes the monreport process as input to check whether the fire info is true or false. In the external clause, the set of control room and mdrone are being read and written in the set of adrone.

Pre-condition indicates that the fire has been confirmed and the method actionorder returns true in the post-condition if and only if the order is sent from the control room.

The next operation is performing action it takes actionorder as input and in the external clause, the set of control room and adrones are read. The process action returns true if the order is received from the control room, then the actor drones’ action will be extinguishing fire.

After performing action, the actor drone will report back to the control about the situation. In the input it takes node and set of actor drone and rbk process returns true in the output.

In the pre-condition, it returns true that the action has been performed. In post-condition drone provides the information about whether the fire is extinguished or not and goes back to its position.

5. Failure Detection and Recovery

The nodes find each other after the network has been deployed. The process of failure detection is reactive for sensors, alarms, gateways, and drones. In addition, the formal modeling and validation of cyber risk to prevent someone from hacking these devices and sending many fake alarms just to mess up the system is also considered in the proposed algorithm [46,47]. The Algorithm 1 is explained further in detail below.

Algorithm 1: Failure detection and recovery

NFDR(NT)

Network is deployed in the subnet mechanism which are connected to Control room nominated as $C{R}_i$

1. For each subnet $SB{N}_i$ gateways are described as $G{W}_i$ where i = 1, 2, …, k

2. There exists $i,j=1, 2, \dots , \mathrm{k} (i\ne j)$

3. If PathGWCR ( $\left(G{W}_i\right)\left(C{R}_i\right), NT$) = True, Then

4. Subnets are connected to Control Room Else disconnected

5. Forall subnet $SB{N}_i$, where i = 1, 2, …, k

6. If PathSS ( $S_i${$G{W}_i$}$, NT$) and PathSA ($S_i{A}_i${$G{W}_i$}$, NT$) = True, then

7. Nodes are connected in Subnets Else disconnected

8. Forall Nodes N in subnet $SB{N}_i$

9.   Crucial(N)= False

10. If subnet is distributed without any N, then

11.  Crucial(N)= True

12. EndIf

13. If (sensor S fails) Then

14.   $S^{\prime }$ Replaced(S)

15. Else If (Alarm A fails) Then

16.   $A^{\prime }$ Replaced(A)

17. Else If (Gateway GW fails) Then

18.   $G{W}^{\prime }$ Replaced (GW)

19. EndIf

20. Forall Drones $D_i$ where i = 1, 2, …, k

21. If PathDD ($D_i,D_i, NT$) and PathDCR ($D_i${$C{R}_i$}$, NT$) = True, then

22. Drones are connected to control room Else not connected

23. Forall drones D

24.  Crucial(D)= False

25. If network is distributed without D, then

26.  Crucial(D)= True

27. EndIf

28. If (Drone D fails) = true, then

29.   $D^{\prime }$ Replaced(D)

30. EndIf

The process of the algorithm is described in the high-level pseudocode given below. The nodes for gateways are described here (1st line). Network connection is checked by finding a route between the gateways and control room (lines 2–4). The connection of nodes in each subnet is checked by discovering a link among each of the subnet’s two nodes (lines 5–7). All the nodes in the subnets are initialized as non-crucial, and the detection method decides whether the node is crucial or not (lines 8–12). The recovery procedure for the failed nodes is given (lines 13–19). The procedure of failed sensor’s recovery is defined as: the failed sensor is detected in subnet then control room will replace the faulty sensor in that subnet with the suitable sensor. Similarly, if an alarm’s failure is detected in the subnet, then the control room will replace it with a new one. The procedure for the recovery of failed gateways is described as if the failed gateway is detected in any subnet, then the control room will replace that with the appropriate gateway. The connectivity of the drones in the network is defined by finding the path between drones and the control room (lines 20–22). All drones are initialized as non-crucial, and the detection method decides whether the drone is crucial or not (lines 23–27). If any drone is detected as failed, the control room will replace it with a new one (lines 28–30).

6. Formal Modeling of Failure Detection Algorithm

VDM-SL is used to define the formal specification of the presented algorithm. It should be remembered that the mathematical constructs of VDM-SL can be used to model any component of a network. The proposed model is divided into two parts: static and dynamic.

6.1. Static Model

In the network, there are several nodes, which are the sensor, alarm, gateways, and drones. All these nodes have similar attributes, so the composite object named Node has several fields, which are described here. The status indicates whether the failure is detected or not. The info is used to record the information of failure. The situation variable shows whether the node is crucial, and connection is used to record the connectivity between the nodes.

The definition of the composite object SNet is specified here and has two fields, nodes and conn. The nodes indicate that there are a number of nodes in the subnet, and conn is used to represent the connection of subnet nodes.

Composite objects

Invariant: It is assumed that there should be two nodes are connected in the subnet, and the gateway node is only one. The communication of the nodes is described by the connections of sensor-to-sensor, sensor-to-alarm, sensor-to-gateway, and alarm-to-gateway.

Network topology is described as composite object NTopology, which has six fields.

Invariant: There exists a control room in the topology, and each subnet has a gateway node that is linked with the control room through a connection. For all the drones there is a control room, and via connection, they are connected with each other.

The object sensor is specified here with two fields, senid and nbrs, and the Invariant indicates that the power of the sensor node is low, and the status is becoming FAILURE_DETECTED if and only if the situation of the sensor is crucial and any info is received; otherwise, no failure is detected. If there is a neighbor’s set linked with the sensor, then it is connected; otherwise, it is disconnected.

The Alarm is described with two fields, and its Invariant is described as the alarm node’s power is low, and the status changes to FAILURE_DETECTED if and only if the alarm’s situation is crucial and any information is received; otherwise, no failure is detected. If a neighbor’s set is attached to the alarm, then it is connected; otherwise, it is disconnected.

The most critical node gateway is identified as GateWay, which has fields gwid and nbrs. Invariant described as the gateway status is detected as failed if and only if its situation is crucial and the info of the event is also received. If the gateway node has a neighbor’s set, then the connection returns true; otherwise, it returns false.

The drone is described here as an object Drone having these following fields: did and nbrs. Invariant specified as: the power of the drone is high as compared to the alarm and sensor. A drone is considered crucial if there are less than two nodes in the neighbors; otherwise, it is considered not crucial. The drone is connected if and only if the neighbor’s set is not empty.

The control room is important in the network topology because all the objects are connected with it. So, it is specified here as ControlRoom, having four fields.

Invariant: The power of the control room will always be high as compared to all other nodes.

6.2. Dynamic Model

The dynamic model’s formal specification is defined further below, where the state, functions, and operations are included. There are ntopology, sensors, alarms, drones, gways, and conn are utilized in the state which are already defined above.

Invariant: There is at least one subnet in the topology, and in the init function, the state’s attributes are set to empty.

The following section describes the functions that are being used in operation and over the state. The first function is specified as PathSS for the verification of the path between sensors, which take sbnet and seq of Node as input and returns true or false in the output.

The next function of PathSAL is defined for the verification of the sensor to alarm path.

PathSGW is described here, which verifies the path existence between sensor and gateway.

This function PathALGW verifies the path existence between alarm and gateway.

For the verification of the path that exists between the gateway and control room, this PathGWCR function is used, and it takes the control room and sequence of the node as input.

The PathDCR is defined to verify the link of drones with the control room.

Over the state of IOTN, the operations are formally specified here. The failure of sensors, alarms, drones, and gateways has an impact on network connectivity and activities. So, this is needed to identify the failure and restore the network. For the failure identification of sensor nodes in the subnets, the operation FailureOfSensor is defined. In this operation, the sensor is taken as input for failure detection.

In the pre-condition, the existence of an input sensor in the subnet is verified. The post-condition is described as failure detected only when the connectivity of the sensor with neighbor nodes is disconnected. The paths of communication between sensor-to-sensor, sensor-to-alarm, and sensor-to-gateway might be broken.

The failure of an alarm is defined in this operation, which takes an alarm as input and reads an ntopology in the external clause.

The pre-condition is described as the input alarm that should exist in the subnets. In the post-condition, the alarm is identified as failed if its connection is disconnected with neighbor nodes. The path of the alarm-to-gateway and alarm-to-sensor may be broken.

The failure of gateway is identified through this operation FailureOfGateWay, which takes gway in the input and reads network topology in the external clause.

The presence of an input gateway in the network topology is defined in the pre-condition. The post-condition specified as the gateway is failed, if the gateway’s link is disconnected, and the route from the gateway to the control room is broken.

The failure of a drone is specified in this operation; it reads ntopology in the external clause and takes a drone as input.

In the pre-condition, it is described that the input drone exists in the network topology. The post-condition defined as the drone is failed if its connection is disconnected, its neighbor set becomes empty, and the path of the drone-to-control room is broken.

When the failure of any node is detected in the network, then it is the control room’s responsibility to replace the nodes with new ones. This operation ReplacementOfNodes is applied for all the nodes; it takes two nodes in the input and replaces the location of the failed node with the position of the new node.

7. Analysis Model

Writing formal specifications in either formal language may not ensure the model’s completeness. Even so, the established specification’s errors can be identified and removed by analyzing the model rigorously using programming tool support. Using the VDM-SL toolbox and its various facilities, the specifications of the model are validated and verified. Validation ensures that the established system meets the consumer requirements, while verification guarantees that the constructed system achieves the requirements defined previously. To demonstrate correctness, the toolbox includes many techniques, such as syntax checking, type checking, integrity examiner, generating C++ code, and pretty printer. The model analysis of forest fire detection and counteraction system is shown in Figure 4, and Figure 5 shows the model analysis of the failure detection and recovery.

Formal specifications of both modules are syntactically analyzed through a syntax checker and semantically analyzed through a type checker. The pretty printer examines the specification for contradictions. Proving the correctness, the pretty printer generates the entire specifications that are included in this paper.

The integrity checker is often used to review the formal specification for internal contradictions, such as violations in invariants and pre/post conditions. In terms of VDM-SL predicates, the integrity properties are generated through integrity examiner that must be true; otherwise, there are potential specification issues.

All of the integrity properties for the established formal specification were found to be correct. The results of the analysis are presented in

Table 2. Formal analysis results of forest fire detection and counteraction model.

Specification	Syntax Check	Type Check	Integrity Check	C++	Pretty Printer
Static Model	✓	✓	✓	✓	✓
state FFDetection	✓	✓	✓	✓	✓
ForestFireDetected	✓	✓	✓	✓	✓
InfoTransmisstion	✓	✓	✓	✓	✓
ReportToControlRoom	✓	✓	✓	✓	✓
IssueMonOrder	✓	✓	✓	✓	✓
Monreport	✓	✓	✓	✓	✓
CROrderforAction	✓	✓	✓	✓	✓
PerformingAction	✓	✓	✓	✓	✓
Reportback	✓	✓	✓	✓	✓

, and

Table 3. Formal analysis results of failure detection and recovery.

Specification	Syntax Check	Type Check	Integrity Check	C++	Pretty Printer
Static Model	✓	✓	✓	✓	✓
state IOTN	✓	✓	✓	✓	✓
PathSS	✓	✓	✓	✓	✓
PathSAL	✓	✓	✓	✓	✓
PathSGW	✓	✓	✓	✓	✓
PathALGW	✓	✓	✓	✓	✓
PathGWCR	✓	✓	✓	✓	✓
PathDCR	✓	✓	✓	✓	✓
FailureOfSensor	✓	✓	✓	✓	✓
FailureOfAlarm	✓	✓	✓	✓	✓
FailureOfDrone	✓	✓	✓	✓	✓
FailureOfGateway	✓	✓	✓	✓	✓
ReplacementOfNodes	✓	✓	✓	✓	✓

, where in the first column the static and dynamic model’s variables are given, and in other columns the analysis is shown. The correctness of the specifications is shown by the (✓) symbol.

8. Conclusions

A well-maintained IoT and Drone-based Forest Fire Detection and Counteraction System is presented in this paper using a subnet mechanism. For the detection of fire, different types of sensors are deployed in the subnets that can communicate to the gateways, alarms are used to warn humans and protect animals, and drones are utilized to combat the fire. The subnets are connected to the control room through gateways, which transmit collected sensor information to the control room. The control room is responsible for instructing drones for visualization and fire counteraction. The sequence of the system is presented through a sequence diagram and graph theory is used to represent the model, and then formal specifications of the model are developed using VDM-SL. In the graph-based model, the nodes are shown as uniquely identified, which helps in the failure detection of nodes in the network. The proactive, and energy efficient algorithm is used for the failure detection of nodes. In our model, the proactive approach is used, where firstly the failure is identified, then the control room provides recovery. With the help of VDM-SL, the developed algorithm is formally specified to reduce the drawbacks of simulations and testing methods. The model is analyzed by different approaches of the VDM-SL toolbox for the verification and validation of the formal specifications. The contribution of this work is that no such formal model exists for IoT and drone-based forest fire management systems with network maintenance. In the future, the proposed work will be extended by doing model checking procedures and visualizing the results using simulation and testing techniques because these are very useful for performance analysis.